Privacy advocates want regulation of behavioral advertising

A coalition of privacy and consumer rights groups have written an open letter …

The targeted Internet advertising phenomenon is viewed with growing concern by privacy advocates who fear that controversial practices like behavioral tracking are ripe for abuse. A coalition of consumer and Internet rights groups have written a joint open letter addressed to the House Committee on Energy and Commerce in which they articulate some specific concerns about behavioral tracking and provide an outline of proposed regulatory guidelines that they believe should be enforced to protect consumers.

Behavioral tracking, a practice that is used by all of the major Internet advertising networks, involves building a profile of information about users based on which websites they visit. This information helps ad companies display advertisements that are more narrowly targeted to the interests of individual users. Major consolidation in the Internet advertising industry has made it possible for a small handful of very large advertising companies to broadly track user behavior across the entire Internet.

Although behavioral tracking increases ad value and helps pay for the rich ecosystem of free content and services that users enjoy on the Internet, it raises serious privacy concerns. The signatories of the open letter contend that behavioral tracking on the Internet has created a gray area in which the traditional privacy protections afforded by longstanding regulatory principles are not present. They are calling for lawmakers to modernize privacy laws and bring these protections to the Internet.

"For four decades, the foundation of US privacy policies has been based on Fair Information Practices: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation, and accountability," the letter says. "Developments in the digital age urgently require the application of Fair Information Practices to new business practices. Today, information from consumers is collected, compiled, and sold secretly, all done without reasonable safeguards."

The coalition—which includes the Electronic Frontier Foundation (EFF), Center for Digital Democracy, Privacy Rights Clearinghouse, Consumers Union, and other groups—offers a broad set of policy recommendations.

They suggest that tracking should be limited and should not be permitted to extend to collection of "sensitive" information, such as data pertaining to finances, political affiliation, sexual orientation, or ethnicity. Companies should be required to document the purpose for which they are collecting the data and should not be permitted to keep it for longer than is necessary to fulfill that purpose, the letter says.

The proposal also calls for new rules to govern data disclosure. They want users to be notified up front about how collected information will be shared with third parties. In the event that the company wants to share the information in additional ways, the privacy advocates say that consent should be obtained from the user.

EFF Media Director Rebecca Jeschke wrote a blog entry this week elaborating on the organization's views about behavioral tracking. The EFF wants to raise awareness of some of the hidden threats that hang over the practice. In particular, Jeschke points out that the data stockpiled by the ad companies could be abused by the government.

"As people increasingly use the Internet for health, financial, and other services, deeply personal information becomes available to advertisers," she wrote. "Another reason to be concerned about behavioral tracking is the threat of inappropriate data collection by the government, which often gets private information about ordinary citizens from private companies. Limiting commercial tracking of our online activities may also help protect against this threat."

This is not an abstract or arbitrary concern. There well-documented instances where the government has obtained a significant volume of data from service providers for dubious purposes. One particularly noteworthy example is the Department of Justice's attempt to get search engine companies to hand over consumer data during the COPA debacle. Another example is the participation of Internet service providers in the federal government's extralegal warrantless surveillance program.

Increasingly invasive behavioral tracking tactics such as those pioneered by Phorm and NebuAd have demonstrated the need for closer scrutiny and stronger safeguards on consumer privacy. The advertising industry has unsurprisingly taken a strong position in favor of self regulation and contends that there is no need for government intervention.